feat: SAML deeplink auth

Merged
YA
2mo ago
+247-16

Proposed changes (including videos or screenshots)

Mobile and desktop apps had no way to complete a SAML login the way OAuth providers already do it with a loginClient query param. The existing mobile path opened SAML in an embedded WebView, which Apple/Google discourage, which had limited support for web APIs, and which being incognito can never reuse an existing IdP session, so users re-authenticate every time.

This PR fixes this problem by making the authentication happen on system browser and then sharing the session token with respective client using deeplink auth.

Issue(s)

Steps to test or reproduce

For proper end-to-end testing we need to run a compatible versions of mobile and desktop app but we can still test without it -

  • Open the login page
  • add ?loginClient=desktop to the end of login page URL and enter
  • Opens the login page with the above appended query param
  • Initiate and complete saml auth
  • It should redirect back to login page with a session ready to be shared with desktop client

Further comments

CORE-2425

Summary by CodeRabbit

  • New Features

    • Added SAML authentication support for mobile and desktop apps through the system browser.
    • Added secure handoff from browser-based SAML login to native app sessions.
    • Preserved standard browser authentication for unsupported clients or configurations.
    • Updated available sign-in options for native app experiences.

  • Bug Fixes

    • Improved validation and handling of SAML login handoff information.

  • Tests

    • Added coverage for native handoffs, invalid clients, relay-state handling, and desktop authentication.